Guides

PF_RING and Network Namespaces
Last week we made a couple of presentations at LinuxLab 2017 where we spoke about Containers, focusing on Network Namespaces support in PF_RING, and User and IoT-oriented Network Traffic Monitoring on Embedded Devices. With the advent of Containers, processes isolation has become extremely easy and effective, to the point that ordinary Virtual Machines have been reconsidered. Many ntop users today are running traffic monitoring applications in Docker, thus it’s important to understand how Containers work and how to make the best use of them. Network isolation is provided by Network Namespaces, a native feature of the …
Announce

Announcing ntopng 3.2 – The First Move Towards Active Network Monitoring
Today we are glad to announce the new 3.2 stable release of ntopng. Among the most important new features available in this release, there is without any doubt an advanced network devices discovery functionality. Historically, ntopng has always been a fully passive monitoring tool. This release aims at complementing the information gathered from a purely passive packet capture with precious extra bits of data obtained by actively searching for devices. Network devices discovery glues together multiple techniques and heuristics, including ARP pinging, SNMP querying, SSDP discovery and MDNS names resolution. …
Announce

nProbe 8.2 stable is out – A Wink At Next-Gen ASA Firewalls
We are pleased to announce that the new 8.2 release of nProbe is out. This release features full Cisco ASA NetFlow support. ASA are industry’s first threat-focused next-generation firewalls that export a rich set of information through NetFlow. Being able to collect ASA data using nProbe will give you an advantage over collectors that only interpret standard NetFlow. Collected data can also be sent to ntopng over ZMQ to actually create a very effective solution for the monitoring and visualization of firewall-generated data. ZMQ-based data export has been greatly improved in …
Announce

Announcing nDPI 2.2
Today we are glad to release nDPI stable version 2.2. This minor release present several fixes and adds support for a handful of new protocols. It also features custom application categories to allow users to create personalized mappings between protocols and categories. The full list of changes introduced with this release are: Main New Features Custom protocol categories to allow personalization of protocols-categories mappings DHCP fingerprinting HTTP User Agent discovery New Supported Protocols and Services ICQ (instant messaging client) YouTube Upload LISP SoundCloud Sony PlayStation Nintendo (switch) gaming protocol Improvements …
ntop

Implementing PF_RING-based Hardware Flow Offload in Suricata
Last month we have integrated hardware flow offload in PF_RING 7.0. This week Alfredo has presented at Suricon 2017 the integration of hardware flow offload with Suricata and demonstrated that with this technology you can significantly reduce packet drops and CPU load. Below you can see how NetFlow traffic analysis and Suricata can both benefit from this work. Hardware Flow Offload with Netflow Hardware Flow Offload with Suricata Shall you be interested to read the full story, these are the presentation slides. We remind you that the PF_RING source code …
ntop

ntop User’s Group Meeting at Shakfest EU 2017
Those who have not been able to attend our ntop meeting at Sharkfest Europe 2017 can find our presentation slides below Sharkfest EU 2017 – Intro Sharkfest EU 2017 – hardware-flow-offload Sharkfest EU 2017 – beautiful monitoring with ntopng and grafana Sharkfest EU 2017 – microprobes Sharkfest EU 2017 – extcap, remote wireshark and demo Sharkfest EU 2017 – EdgeTrafficMonitoring Sharkfest EU 2017 – what’s new, new products and roadmap We need your feedback and we could be glad if our community could give us guidance in the next steps. …
ntopng

Network Device Discovery. Part 1: Active Discovery
Since its introduction in 1998, ntop(ng) has been a pure (well beside DNS address resolution if enabled) passive network monitoring tool. Recently we have complemented it with active device discovery in order to find out if there are silent devices in our network, and what services/OS our devices are featuring. In this article we will analyze how active discovery works, leaving to a future article the analysis of passive discovery. Active discovery can be started on demand from the menu     or from the network preferences to enable periodic …
PF_RING

Introducing PF_RING 7.0 with Hardware Flow Offload
This is to announce a new PF_RING major release 7.0. In addition to many improvements to the capture modules, drivers upgrades, containers isolation, the main change of this release is the ability to offload flow processing to the network card (when supported by the underlying hw). Flow offload is a great feature for cutting the CPU load when using applications doing intensive flow processing, as it’s possible to let the network card handle activities like flow classification (update flow statistics) and shunting (discard or bypass flows according to the application …
ntopng

ntopng Grafana Integration: The Beauty of Data Visualizazion
Disclaimer This article is outdated: please see this document for using ntopng with grafana Summary Grafana is one of the most widely known platforms for metrics monitoring (and alerting); ntopng version 3.1 natively integrates with Grafana thanks to a datasource plugin which is freely available; This article explains how to install and configure the ntopng datasource plugin, and how to build a dashboard for the visualization of ntopng-generated metrics. A video tutorial is available as well: Introduction Grafana is an open platform for analytics and visualization. An extremely-well engineered architecture makes …
ntop

You’re Invited to the ntop and Wireshark Users Group Meeting
On November 7th we will be organising the ntop meetup during the Sharkfest EU 2017 that will take place in Portugal. You can find all details here. This year we will be focusing on cybersecurity, IoT and user traffic monitoring, as well on Wireshark. In fact during our talk at Sharkfest we won’t have enough time to explain in detail all our activities for turning (or complementing) Wireshark into an effective monitoring tool and not just a packet dissector. We welcome all users of our community (attendance of Sharkfest EU is …
ntopng

Announcing ntopng and Grafana Integration
Disclaimer This article is outdated: please see this document for using ntopng with grafana This is to announce the release of the ntopng Grafana datasource that you can find on the grafana website. Using this plugin you can create a Grafana dashboard that fetches data from ntopng in a matter of clicks. To set up the datasource visit Grafana Datasources page and select the green button Add a datasource. Select ntopng as the datasource Type in the page that opens. The HTTP url must point to a running ntopng instance, …

High-performance network traffic monitoring and analysis tools.

Explore
Newsletter
Subscribe